CVE-2025-5259

CVE-2025-5259: Minimal Share Buttons for WordPress is affected by a Stored Cross-Site Scripting (XSS) via the align parameter in all versions up to 1.7.3. The issue allows authenticated attackers with Contributor-level access and above to inject scripts that run when users visit injected pages. R...

PT-2025-23268 · WordPress · The Featured Image Plus – Quick & Bulk Edit With Unsplash

Name of the Vulnerable Software and Affected Versions: The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress versions up to, and including, 1.6.3 Description: The issue allows authenticated attackers with Subscriber-level access and above to update the featured image of a...

PT-2025-23252 · WordPress · Minimal Share Buttons

Name of the Vulnerable Software and Affected Versions: Minimal Share Buttons plugin for WordPress versions up to, and including, 1.7.3 Description: The issue is related to Stored Cross-Site Scripting via the align parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-23251 · WordPress · Ninja Forms +4

Name of the Vulnerable Software and Affected Versions: The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress versions up to, and including, 1.4.4 Description: The issue allows unauthenticated attackers to retrieve the full path of the...

PT-2025-23277 · WordPress · Simple Page Access Restriction

Name of the Vulnerable Software and Affected Versions: The Simple Page Access Restriction plugin for WordPress versions up to, and including, 1.0.31 Description: The issue is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This allows...

WordPress Quick Contact Form plugin <= 8.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Quick Contact Form versions = 8.2.1...

WordPress Responsive Plus plugin <= 3.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by domiee13 Patchstack Alliance in WordPress Plugin Responsive Plus versions = 3.2.0...

WordPress Flynax Bridge plugin <= 2.2.0 - Unauthenticated Limited Privilege Escalation vulnerability

Unauthenticated Limited Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin Flynax Bridge versions = 2.2.0...

WordPress WP Extended plugin <= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by rajanhoyr in WordPress Plugin The Ultimate WordPress Toolkit – WP Extended versions = 3.0.15...

CVE-2025-4682 Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgets

The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML attributes in Slider and Post Carousel widgets in all versions up to, and including, 5.4.0 due to insufficient input sanitization and output...

WordPress Property plugin 1.0.5-1.0.6 - Missing Authorization to Authenticated (Author+) Privilege Escalation via property_package_user_role Metadata in PayPal Registration vulnerability

Missing Authorization to Authenticated Author+ Privilege Escalation via propertypackageuserrole Metadata in PayPal Registration vulnerability discovered by kr0d in WordPress Plugin Property versions 1.0.5-1.0.6...

WordPress plugin Essential Blocks 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-4336

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the setfile function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

PT-2025-28934 · Ип Кривочуров Дмитрий Анатольевич · Импорт Из Xml

Уязвимость плагина «Импорт из XML, и YML» существует из-за непринятием мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, провести атаку межсайтового скриптинга XSS...

WordPress Leadinfo plugin <= 1.1 - Settings Change Vulnerability

Settings Change Vulnerability discovered by Denver Jackson in WordPress Plugin Leadinfo versions = 1.1...

WordPress WP Job Portal plugin <= 2.3.2 - Arbitrary File Download Vulnerability

Arbitrary File Download Vulnerability discovered by LVT-tholv2k in WordPress Plugin WP Job Portal versions = 2.3.2...

WordPress Visual Header plugin <= 1.3 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by HLog in WordPress Plugin Visual Header versions = 1.3...

CVE-2025-4419

The Hot Random Image plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.9.2 via the 'path' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to access arbitrary images with allowed extensions, outside ...

CVE-2025-4405

The Hot Random Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2025-4603

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to delete arbitrary files...